last executing test programs: 2.65445025s ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)={[{@quota}, {@noload}, {@init_itable}]}, 0x1, 0x4ec, &(0x7f0000000500)="$eJzs3c9vG1kdAPDvTH44zWY3WVhpAQFbloWCqnUSdzeqeioXEKoqISpOHNo0caModhzlRyGhh/R/QKISJ/gTOCBxQOqJOze4IaRyQCpQgRokDkYzHqf5YbfR5ofb+PORpp43rzPf76s7702eFb8A+tbFiNiOiOGIuBMR48XxpNjiemvL/t7zZw/mdp49mEui2bz1zySvz47FnnMybxXXHImIH34v4m5yOO7a5tbSbK1WXS3Kk+v1lcm1za2/LtZnF6oL1eVKZWZ6ZurqlU8rJ9bWD+q/efrdxRs/+v3vvvLkj9vf/lmW1lhRt7cdJ6nV9KHdOJnBiLhxGsF6YKBoz3CvE+EzSSPicxHxYXb/N3udDQBwFprN8WiO7y0DAOddms+BJWm5mAsYizQtl1tzeO/FaFprrK1fvtfYWJ5vzZVNxFB6b7FWnSrmCidiKMnK0/n+i3LlQPlKRLwbET8vXcjL5blGbb6XDz4A0MfeOjD+/6fUGv8BgHNupNcJAABnzvgPAP3H+A8A/cf4DwD9x/gPAP3H+A8A/cf4DwB95Qc3b2Zbc6f4/uv5+5sbS437H89X15bK9Y258lxjdaW80Ggs5N/ZU3/V9WqNxsr0J0Vhe3Jtc+t2vbGxvH47/17v29WhU28RAPAq737w+M9JNlRfu5BvsWctB2M1nG9prxMAembgeKf75ADeYIO9TgDoGT/jAx2W6N2n/aA/drCi1PUUXQu85i590fw/9Cvz/9C/jjn/D7zBzP9D/2o2E2v+A0CfMccP/ez9/M+jfv6/z3BEPDqNnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODNMJZvSVou1gIfizQtlyPejoiJGEruLdaqUxHxTkT8qTRUysrTvU4aADim9O9Jsf7XpfGPxg7WDif/LUWx1NdPfnnrFz+dXV9fnc6O/2v3+Pqj4njlpYGKpQZLuwdKJ94WAKCT9jjdHsfbnj97MNfezjKfp99pLS6axd0ptlbNYAzmryP5g8Pov5Oi3JI9rwycQPzthxHxhU7tT/K5kYli5dOD8bPYb59p/HRf/DSva71m/xafP4FcoN88zvqf653uvzQu5q+d7/+RvIc6vnb/t3Oo/0t3+7+BLv3fxaPG+OQP3+9a9zDiS4Od4ie78ZMu8T86Yvy/fPmrH3ara/4q4lIU8ZPYF39vrMn1+srk2ubWx4v12YXqQnW5UpmZnpm6euXTymQ+Rz3Znqk+7B/XLr/zsvaPRuf2j3Rv/0h27BtHbP+v/3fnx197Sfxvfb3z+/9e9/j5mPjNI8afHf1tx+W72/HnO7e/OKf7+3/50NUudIzx5G9b80dMFQA4A2ubW0uztVp19Xzt3C0e+F6XfPbtDPUgsYhsZ7jnbbeT7WT/A07iOu+fYqq97pmA0/bipu91JgAAAAAAAAAAAAAAQDdn8QtPvW4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA59f/AwAA//+ew88F") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101041, 0x15) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000200)={0x200003, 0x200003, 0x801, 0x80000001, 0x7}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xe7c) 2.293056919s ago: executing program 3 (id=13): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 2.281785861s ago: executing program 4 (id=5): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f00000000c0)={0x40043, 0x0, 0x1, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0, 0x0, 0x0, 0x0, 0x40800}, 0x0) 2.245023229s ago: executing program 3 (id=14): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$loop(0x0, 0x6b, 0x901) setitimer(0x2, 0x0, &(0x7f0000000380)) r4 = socket$inet6(0xa, 0x802, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) connect$inet6(r4, 0x0, 0x0) fcntl$setstatus(r5, 0x4, 0x400) timer_create(0x3, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x4c80, &(0x7f0000000600)={0x0, 0x0, "05d3000028000000000083eb29e46b4bfb57461914278705b6a55ba904cefb1f00536dfdc9ce9c12d1207f8a35d1dad7ed0fc16b2ccd00000000000000080000000c0996d78e489e96651d35ca509de7cf52e7578e9ce37700000000000032936e283ae72a84cc5a72f07fef2fec1463729b336e892b5aadc70f51cb7e5925747f779254377a6a42493fb7026e77fb899a2072631f76cd0a59b17031b431163758724ac0df2d95b9c3fbccef0111f1fc6db466c73268e04c38df1f6bf2cc88aa6126229c332b887eb8e67112000631988ad55f281047000000000000000003000000000100", "2fc7eecad58f368bf3ba45a6f7874bf0f0a2e2d039d23b33645c7a714b200d1ec427e16f2d87c3a7f0a258b1856e10dbfadd1f9f5b294c68af413bb746e6b0803177028065618aa080c2ca8efe18fbb6c85459e9ff5c1aa9c17498a05220b09c2d859832bf5ae846009f6a415023b9a7110bda56f514841bf04e54bf592d28107037e86729ff5789dd40d9180160cf72a92609650dc97d806d75465c3cbabb3e8f59afcd807086dc9a87048f229a1c8b183c2077b18922f8dcade6cbf835b715887e9a20c69f14468fb321e017c8a2361f5300617d2ff15e5e2df6b8fa425461dc9c997020beed571b01b0ae899a7a21fe7f9dce8b2ff0374cde255fe2cd3444fa236242d0a976de3ceed2abb0bcb9e4580db4bf248fa20f27dc7c9a953b420f032e6fe0de2a657b7903f0a3d4d67908255b1ac3274313a683ad8a328816336d20dbfdc9f262073dade576891220dd05e0cb6e97bb433637adb6f42c3a040a0089d9a86b42dffeba614460c184bd405cf3749fad5a47609eeb5c48f0222ea459597a0fa855c9d6d789ed17235c6cbf62757d54c99a03b777b7af6058a33b32aa49973625747e0ff1d3c4898a1ea7e68807d9be2b9ca09de22790441964131b1e6dbf633f06c23ddb02736a741396cb1c3dbe49eabdad6f662ee642be86560e24bf2578bc93119d19b446587a8455b445e1cbcb86848331888a8a8adb0836628a73c9c41f8501ae67caa0165fca251674fcfd5f78415a4497519f0d4a79ba166a55721c4db05be7155ae7bca92f4fff5cdcf2d581d2da972ee240355984210e5927904ee74bd15da96d23e0b5bb07ce1adf2683032e8ae4dd9dd6f5bd841ef30ccdce954426f1cf29f2f35decb485f4faa36caae23e7d136317dbb6ace192dc0484d5e3cc341dee5041430dcd5f320a9f3679196bd2a2348619c4a55e090cecf0da78fdba2b25a3373a813d5e719ef2fbfea38035828e28d1666b64dbabce44140e9f0c7e8685e69d8192d1953c1dba2c2a471658538ade2e295732c4a23ca63b54252673ea15374da608ff431e56c9b74bc88b858511910a8ff6a294354093449e90994cf70a60cb108e19ad7625c27bc7934076a8a8fa8a14b06b0e94813a9ff3961e251856a0d34b728025121cf045be55d3997ca1ba4643509fb7eb84b1dbf97663f63fbf32b32f92eebff4ff420cd8c45fda163c09aa879283c282ef4bc93d416854ada56921cc6f82a67a3d024c1a828eb8d4c901f6066f8df327f694f828124d880da4f98c66087f8a825b9b01609f980a0f48c471fdcb7696e493a02a7b34420ccddae0e26b8f4db77ee712ccbc480fb8fe625d51ee2ead77637b9f7bd4a70fc21581498915c72ce999eb2a3888ad4c66c5e623d2f9c983f4c3e17714a63af06c222a62671b407a8f30619f1cb8a9efc177a18ceefc0760a27f5001124e81eeff04950364cf1881c03c1cc99b1e5dbc36ec94ed875c54a87dc18143303b2ad34738e683fdfe7e257fa5609e785e3c81dcd387bccfba8d31077b2140b06a361167ab1abb6e8c9b6e7b8918c992a7c4fce8797048bc3eba6ef7f65789b6d59ce4e4dcc5a3d44b9ef24de8996347c79cbaaaaef13dbac1dab9fb6090a757be36cf3e15bcde5bddc318bd42265371ebfe941f63a5d2dbcd9c6103ab91b5c292ae86e4dc6df13194dd81319db2ad7f51fe377196b2b87db9614cd1d572f3df9b518d36aacd8c4f454c1a61fd587642e87e8a4d4029e46064cc730e7b75efae0e6b798184b33365160696e327ce80ad8ec0a5c20e57b07b2cc19f849b1c527994b6631ae61bd9c6703966d141714bffb6cfb7708e2c6669cf33f42c8e8130d73a2bdb42bbd3316e1a2deae59b7bbe6e77518326d11714ac543143c8bc4c9cf39d84b06bf10ad463d7b9d14f5d44d98c78f5bc96793c254a652e300065a0e568234110f4f3d93b584b5767e41cb9d2514a16138d8dd650b885b6ac87ce233957dee5c1d2004fc5882d41ffcc1751d565ad92d04ce0cf0221ac7d7a0441f4024ce74ff4d3df9559026ebb5b5602ee9e8d87f189b8f6e61879c417a00321e87ceac1b952e51700d384ed3b07c70fd8be0d61290b6100abc393bfd33f425892509e55350797f139b64b68e357f66a1776504ea67689ca482534308c9c7b76c7f9fbe1d1cc739dee391c0b7a781d6bade90ec2a46f617d436cc7f51eb1c94de092ccf1d7b57c31fc1c8e18b9bab9858792a129dfa62b379d22aec6129065a867bda550337e30edcfc0732a5b69559c8d45270d7df9d06b385c51a05e57280d66f5c02c7ca1f463e6ef6d1d2e3b04c6df77fd88e06197acf4d5287660e90d7b1d5d4b7410d44e36aa3652e86d9b97935fc19459bd1e7f155e497bee58013f9cbef97b669b3d8fbd77a286a50b86aa11e4376e44275297bcdcb252ad8ca4742a6cd66563c4ba6318b765899d853043877b6400d654ba955fa6376857b6307d443168211dde06a156d8908269ab033c9de9546b3cc41583e7cae7038720d909fed58b52f7bc7aba12b1be3a2e23474af919426326556cf37d584c4e905f8d84604fdb192f0993b213107fae21c323d69f3113d2f5d6371a49a40b98030868c824ff0916556044bc32ce80497c46c01e254e2accfd01aeabf18c545b907cd5fd0b00a82c42e644690ad1099dc3ec5e0df8c5d783ec93e6712857137eee4d06762fa12233d1ba4e7bc597d970a434ce615ffe432f6289bd297f7973f29e8460391c44cab29f2e21f639e7aea6c0c7e57a35585573b88ce6a2beed7807278b73a9eb21d82a477f7f9eef24c1cf0b7fddee8b3dfa633cb37c3f1ac53f34acd6dc0e29494d644f9bdce8d65e734fa52d1cdd0f147d48f02000b31fd0dcd2766cf8ea8b92bd340195c6833e4320eaf125ad61fa8772ac380f363fd2b3b5df23aa0e08034cfe5963fada592e851f5b274e6defae6cb1dbc5f29c52855352d8417262780ba7c8040cac21a0fda09a76af7a58b66f9a89d35f7a957548cf49f7117542a2f0f2c1c8bb371eba256aaac009798a97a27a62256fafad3988bb9b577eb00c06d28a91c85aa20f176e44e52b37a8068bfec1434c1277e68619e8459f83359976c81ca49462e1b9abf83fed9d4e08d9fdc6626bd73099ff8c2e95384e0517eff3e02a1882ef5a804989ad5a9536628f3989631f610ba9172c92c44c372ff48d590be9896e741001b3ea511727a1476d706debdea7216e1bf2461fda61a7bc6db99c098fe4f32eafbe2ac15782ddfd1609cec300015b542c835ff195cd779699d8ced1edd571f3734ef6373c526553ee9684674cd5ae1e8f390065ed761257cbb120168dcebacc94f22a15d6bc8444afff61601305c9212f086ae5a322968983568bfaed808fd935a8260709781a58bf3cbc3256e81d272a9c1271b93a1f97feebe77e94912e0361c149076abd1aa186ac38e65d879e92bc58bc7adde9339f712b8a07d798ad573318559a31c1e64354bfc5f3e9a195118cab384d9b7d192305e5fe6e8eaebd7403095e3833fb3a6425e7b8b7ae0515d5cba8a19c2b49e33cd9bedbac96f01c5a24ddc36b35f16cfd55ec584f18ecf7313a812d5d44b6ac02808ab4389e7ed6426454d9f4c69a288d36a211f27c4770cad16daba3c97e0d51a7012ba7ee4881daf21ca720c0a14d54852516c8342989ed328d13366be829416218e0d2cc9c708a06669873b4a7a32e35dbc59d5f7eeebb7fb3c307e84c287c2e3a921e94149a90a56e4c8bcf954844eb7edefea72690c518075cdce72c222961c388ba8cb9e2f881582131cce0898c86ab2f7c1a925301eb6a33bf33baf957f18d648b55e0c613db371343cc7ce89f91423629e644b286bba4d8b4cbb116e30da5f7a4bba8606093fe5d6bad8bc5f98fb1ac476bf8724a8008a725ed3aed86c763f2eac7d77f1ef9a96702e13ec5080bb82606741e08fde37aceb1dd32c11afa92be85ff46ec2010ce17d5cf92e91243ccb1070000002a746ca1f1135b1b0638ffe19c8b31644a08f9f1990685e0f458f096daae910e9f36a83a8ba01dde2b5d0d3097b1cf03be7aee0a8c7c4c8672d45c6310e7d2e5558143ad9e79a9751b8ac54a3e86fdfd9320ef69c7130460e259462be21db94fcbd3181903130f3f982f4c8011bfe62bd5903ad8713281be0fa8de38553ea6c3e566152518bd80fbeb5863f0de7c7cf26606b48b63c89d9f9c798816e7e1e1dbb3946a1048ebf383f117ac9bf565a277086fd9cc0250dd22cf1d2c3cf58fa227f4f2c201be2df79230b6a95333f3a3ded0d11f9b647da9b4cb70fa02631552df57b7a6009b1b36d8f7c9f2fc7ac53912f29e79fdb57acecd431adf2dca1c0e7d31d7ff38ce7b3089416d9ab4f7474f1b68141228d4350ad7541676caf115e6c4eeecc706e0268c2eda740cce7a22e1090fb0216608a13c50316ee056414d0dfce99ab3f9c4619df20d7e0c254c3e9a9717f140b1a4ecdba1ca5ce3bb252083a69bb107338184f55d064c912745aa81588de2299fb9f77201c5ded7cbf572b64c0d6d300344226355d1a4cb8088e43780e01e190e9b877ba14431d115296e31c2cc0266c0df82da2530ac1e094cdfee42fcfdb8ee5d03c251d24d5b0fefafa7b9c2a2e73a814e768d57a5429372dce6266dc547a4c93a05dece1e7601a658d4855843db66ba8ecae9cd1703d66a3aff1be2be77c0ce96772d570c73f88d028eb8716dcb5e49792b39f1a5a4275a4f83d8ae2ea8883bbfaa42050392da86d7a4a22835553cd2fdcd0cca630ad003c4a15ae0b7a7cee875b5a08f0ef70d86187054260001c9698419bf1569b1802439cd3fe320d9272b853e7b34a322a5fbade5cd3ad0e1c4b07d111981494215d3b82c2fe8a7697052a3b7b1ef3fb22d5e33e57c8d422b5e3dc9cf1a5df5401559c56610f44a4e409b12aa82bf661c17a2bb76e469583531f782b55da4eabbb68cb39bf32844398fe0ffb79e4c95e3e3c3ed3e9ac304cf1980b7cde8fcf76966cca196748e4ad7a02debd6ccc4a3e9b8adaa7dc668a76cbd137b2e6fbc673900000100000000009bf5ed16d5f5818535802fa7627a7d352f4216ba3f84481394c0500b7aea67e838d5dd0422eeb940ad42546e1f3c2cd85c53abbaada51b5571323d7ea53d436c2d349befca87909c1dc2a23d2db53ecc272b80896b65fa0cad8854e6b36e052ecbe677024b9614a180fc54c20fac7ed4d16e7ba17a368f0a00a036d23ae4b19ad3d99642ff054850233b60e706a4f575e49234acc76211a5bace9b8417eb6d986dab4bc6b8b510ee0477f6b8738f00709b7f35aac1730017c0037e5c40404d145b527a29500fab1e3c00"}) r6 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r6) 1.557343669s ago: executing program 4 (id=22): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) 1.533282245s ago: executing program 3 (id=24): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x298, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4, 0x0, 0x8}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000000400)={&(0x7f0000000140)={0xa, 0xa, 0x1004, @mcast2}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001080)="671723d7c6012c", 0x7}, {&(0x7f0000000200)="9efe80000000000000dfe52c1f51218206f5abfd2a00"/33, 0x21}], 0x2}, 0x0) 1.503229981s ago: executing program 3 (id=26): r0 = socket(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d38a2fa77262a334b70da13159214b59e99043f2d45738cfe619d4e54d9d9d52faad4185dc1461e3de1d4a8e2bac117f496b9198352ed12b367de480013f50733fcce28686f100f105d037fe1d3c387164fd3bb6d9f758e8c35de274cc824e0ef8a4ec4d740cb37a646300158bd9f137d0712242f3ff01641eedbf6207cc3e7b9314e8cd44581f210ae9980710a38a426305d71a732645e48a5faf121177bb16c0253dbba4b6495b2fdf147bf3557edbf1134ad8135eddb75535613f0c13e995f458d7117b7b4484be02dda974d1f894074f5258bc3416e61b41949c2bca7746dd9edc6fc1d0b9305c7ee799be795a7df68f76872046beb4e1ff6d5a62a7177902fdb74cb5d1e104b8852fd4db5ced74b73b68eb138695110452ddf5def0a6961d7010d1b170391e5897f32102ebade663ec2804708f63becf2b7595461d10062df096794e1cb4232cda841f3a86a6d5e50fe8db194bfb3721c9bc3e29b176f3554f1010776afe8fe89b5869bb25e5ffe24ad26f382b7176fd85e3d19a2d8e58031e1939ed39c96c4f2f967f75049ee7e36469b8c010992623f8248cff1c362bbb12e8ed5fd05b72fb1f391b4c13d06a453f2169bea0cc67768e06311494a3dc736c80ef644fc0d09dae7dfc09de2b7f6d0b21734486503b74bd3387ffa9a5da1b39a2ec9c410a4b2d4ec1f8ef1d3a7ced2637878b038da8d69b32a3e402580e5b746f8e7f930ff478e6b15f475b6b96a25cd8f55bdd73bc483ee5625b56b81f8d9183bc36a5c4c0974db6ad499bf1fcccb994c3defccf1324543260fb1a790ef60d50da4f955783af41066d51abdf7a566c2b2c876e0199e7b920068f226c7a5f14b65b3dbd7fb244c3fb1660740b5f849942e468af39e5a9bc80a6075878dfac23d0ae839a0e509448130e7dabadd7c494b64e67be6400ea34b097bfc578deb3c5ebefa9c1019ef65bf641c9388d9b29f6c9c2e5b8b81fcfdd94059d9a21c80f318d9675721a31ca77a4920b06cb744e96ae74ef66b4dfbe5d1085c9485abf9356d966cb63a75a250dc4432b89ec09dff3531613e12694abdd61d270ab34fba12ae1db3ed45fbc87eb1725f962de4922a64c82ed5d4b652ad926be7330f15fee7a6d53719f6231be26e7593454eabf6fdfe940f04c8cdf022ce9e278c0e2ce9aa9285594972d2b910cedf1d956976f9e6d9571210e4939821c9b68146925e2780db8e1fe6872ba1e178dfb627d9623b5c700cae1d3ce830422b9d906060b28d0956af355a2ce927c9cde8391b43fdbccd428403ee758de7c09de5a2c8eb2dac85a0e056b1ce291da6e54ea1e669b5eee9ca1043aa4f92368b39920f23f2ce3ea3906412de447a0ba28474f2b839a0413e1a0c5c1e7e818b6ae483fbf9a5fcf9367cf9badb8d2040e54dd868a672f3d24fc0e9a77648acb524999c46061b5a71cc8e0b3e66e5421b4e4f8ade64015793a", 0x50b}], 0x1}, 0x84) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8, &(0x7f0000000a00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x130}, 0x12060) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.489191894s ago: executing program 4 (id=27): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f00000000c0)={0xb0000004}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000000)={0xa0000001}) epoll_wait(r4, &(0x7f0000000040)=[{}], 0x1, 0xffffffff) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x40000000, 0x0, 0x0, 0x83, "000000310000c948585fffff00"}) syz_open_pts(r0, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000bc0)={0x7, 0xdac0, 0x8, 0x7, 0x13, "4dd5d26bd8b1eb227705ecfba7158d29559dba", 0x5, 0xa4}) 1.442319684s ago: executing program 1 (id=30): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000009400000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) r3 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r2}, 0x8) close(r3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.429861538s ago: executing program 1 (id=31): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000005c0)={r0, &(0x7f0000000400), 0x0}, 0x20) 1.41792131s ago: executing program 1 (id=32): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_GET_TID_ADDRESS(0x28, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) syz_open_dev$loop(0x0, 0x4, 0x80000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24040084) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004804) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) writev(r4, &(0x7f0000000280)=[{&(0x7f0000001900)="a6bc6acf1b949a370e2ee5b5977a3b250b64cfc094050cf9e592f0ee7435e3c671d9796fd71cd24943e62a8feee86e6d5144ca40a6724b36a5e3d0dfa794fd7b1fdd2a90975a989ea04ce9a46f412f16f6c4ea56f6d6a483f7c0b541b4252c36b067bacb433728f65fd29f8ae347dbf5509e4c95f4f43b3c05224176183e524f94c30d231c3313ec87574075675a8f2c497aceaf014b556648c1a1b2a12bda46d1cd7ebdd176c9e700898ed8b7f2e9a6eb14d612bffcc5aa857275", 0xbb}], 0x1) pwritev2(0xffffffffffffffff, &(0x7f0000000600)=[{0x0}], 0x1, 0x1, 0x81, 0x1a) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f0000000140)={0x0, 'virt_wifi0\x00', 0x1}, 0x18) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x2, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) recvmsg(0xffffffffffffffff, 0x0, 0x40002002) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) 1.399076274s ago: executing program 2 (id=33): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file1\x00', 0x800, &(0x7f00000001c0)=ANY=[@ANYRES64=0x0], 0x3, 0x2c5, &(0x7f0000000580)="$eJzs3U+LG2UYAPBnsslsyh6yB08iOIcevFi6vXowRVYQ96Tk4B/QYlsom1DYhYB/MPTkJ/Dgwe/hzbvgxW8gePDozSILr8xkMskm22yzmlbq73fp22eeZ+Z53xk2C2He/fSV0fHdh6f3H331a3S7WbT60Y/HWexHK2ZSLQCAF8LjlOKPK32+t1vb6gkA2K6Fz//OE1J2V0NvbrstAGCL3v/gw3dvHx0dvlcU3YjRN+NBFtN/p8dv348HMYx7cTN6cTb/LiCl6fjtd44Oo12U9uP6aDIelJWjT35uUvOo6g+iF/sX1x8UUwv1k3G7+s0jyyIe9MtGbkUvXlqpL48f3rqgPgZ5vNatJ1le/0b04pfP4mEM4271ncb8+l/nUbyVvv3zy4/K5LI+m4wHu1XeXNp51vcGAAAAAAAAAAAAAAAAAAAAAIAX142isR/XR2Vouv/OYOesOj5PKP9b7a/Tqo5P67OIvBos7Q80SfH9bH+dm0VRpGya3+zvc60dL7ej/bzmDQAAAAAAAAAAAAAAAAAAAP8lp59/cXxnOLx38q8M6pf8m9f6r3qe/kLk1VifvLvRtWKnTi97Xc45+OnjURMpJ3GV5sedImJdz52VyLWyn8vP/FdKKWVZxD+7TZ2nudYlg731OeUC//jd3uvHd7KlNezUy99EurMb98PiefI4mT1LTXlk6y96di6SNnr88jU5ed3IU51nb5PF3F3t8I3fzq1PdsksOguRTj2IJz1+3Y2e5+3/7AEAAAAAAAAAAAAAAAAAAM6bv/R7wcFHa0tbW2sKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ6x+d//nw9iJbI0mMTv0atPsJqTUpo0kTxOTp/zFAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//+nhkpw==") r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) truncate(&(0x7f0000000240)='./file1\x00', 0x3c4c) setns(r2, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 1.292222517s ago: executing program 2 (id=34): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r1 = dup(r0) ioctl$PTP_EXTTS_REQUEST2(r1, 0x80503d0a, &(0x7f0000000040)={0x8, 0x4}) 1.257331275s ago: executing program 2 (id=35): socketpair$unix(0x1, 0x2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8, 0x0, 0xffff, 0x8, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@random="d9ea693249ca", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @echo_request={0x80, 0x0, 0x0, 0x7, 0x9}}}}}}, 0x0) 1.228512741s ago: executing program 2 (id=36): syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f0000000180), 0x2, 0x790, &(0x7f0000006a80)="$eJzs3c1rHOUfAPDvbPPSX9qfjSBoPQUEDZRuTI2tgoeKBxEsFPRsGzbbULPJhuymNCGgRQQvgooHQS89W603r75c9Q/w7kFaqqbFiAeJzL6k22Y33aTZbMt+PjDJ88zM5jvfeWbmebIz7AbQs0bSH5mIwxHxURJxqDY/iYj+Sqkv4mR1vbXVlVw6JbG+/sYfSWWdW6sruWh4TepArfJERPzwfsSRzOa4paXlmclCIb9Qq4+VZ+fHSkvLR8/PTk7np/Nzx8cnJo6deP7E8d3L9a+flw9e//jVZ74++c97j1/98MckTsbB2rLGPHbLSIzU9kl/ugvv8Eq8s9vhuirp9gawI+mpua96lsfhJC33dXuTAIAOS0eh6wBAj0n0/wDQY+rvA9xaXcnVp+6+I7G3brwcEfur+dfvb1aX9NXu2e2v3AcdupXccWckiYjhXYg/EhFffPvWlXSKDt2HBGjm3UsRcXZ4ZPP1P9n0zMJ2PdvGOiN31Tfi/9J/n9GBe/kuHf+80Gz8l9kY/0ST8c9gk3N3J1qe/xsy13YhTEvp+O+lhmfb1hryrxneV6v9vzLm60/OnS/k02vbIxExGv2DaX18ixijN/+92WpZ4/jvz0/e/jKNn/6+vUbmWt/gna+ZmixP3k/OjW5ciniyr57/pYYlyUb7Jy3Gv6fbjPHaix983mpZmn+ab33anH9nrV+OeLpp+99+oi3Z8vnEscrhMFY/KJr45tfPhlrFb2z/dFpbXVlPIq7sfqbNpe0/tHX+w0nj85ql7cf46fKh71sta5J/rv6/UFXz438gebNSHqjNuzhZLi+MRwwkr2+ef+z2a+v1+vpp/qNPNT//tzr+09HJ2Tbz77v++1c7z7+z0vynttX+2y9cXZvZ1yp+e+0/USmN1uZsff2rXrfb3cD73X8AAAAAAAAAAAAAAAAAAAAAAAAA0I5MRByMJJPdKGcy2Wz1O7wfi6FMoVgqHzlXXJybisp3ZQ9Hf6b+UZeHGj4Pdbz2efj1+rG76s9FxKMR8eng/yr1bK5YmOp28gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQc6DF9/+nfhvs9tYBAB2zv9sbAADsOf0/APQe/T8A9B79PwD0Hv0/APQe/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAddvrUqXRa/3t1JZfWpy4sLc4ULxydypdmsrOLuWyuuDCfnS4Wpwv5bK44e6+/VygW5ydibvHiWDlfKo+VlpbPzBYX58pnzs9OTufP5Pv3JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2J7S0vLMZKGQX1B4CAp9tVZ7ULZnR4VMPYm9CjrQxjrr8zdPbTuLB2Bndq7QxYsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEPkvwAAAP//vI8fOA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) truncate(&(0x7f0000000940)='./file1\x00', 0x2fffffd) 1.164231725s ago: executing program 0 (id=37): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x10004, 0x5, 0x84, 0x6, 0x7, 0x83, 0x6f0d}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b00)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {0x1, 0xb}, {0xffff, 0xd}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x4000003}, @TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x0, 0x2, 0x3ff, 0x8, 0x2}, {0x7, 0x2, 0x5ec, 0x1, 0xad, 0x200}, 0x8, 0x8000, 0xb9f}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x9e53194a6724d2b5}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r5, 0x1, 0x2, 0x6, @local}, 0x14) 986.971194ms ago: executing program 0 (id=38): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x8000, 0x8f, 0x0, 0x7}, 0xe3, 0x1, 0x1, 0x7, 0xff7, 0xc, 0x1, 0x10, 0x7, 0x7, {0x6, 0xfff, 0x10, 0xffff, 0x69f, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0x6c, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) 874.192959ms ago: executing program 0 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x15f) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xc) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) mount(0x0, 0x0, 0x0, 0x20c86, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="04000000000000003f00000038010000380100000000000000000000000000000000000000000000000000000000000074") 837.728337ms ago: executing program 2 (id=40): syz_usb_connect$rtl8150(0x3, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x800000, 0x25dfdbff, {0x2, 0x18, 0x51, 0xfe, r3}, [@IFA_LOCAL={0x8, 0x2, @loopback}]}, 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f00fdfd}}) 385.991825ms ago: executing program 1 (id=41): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00', 0x2000}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f"], 0x18) 376.495718ms ago: executing program 3 (id=42): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3, 0x8f5}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031c00d3fc142efd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 338.752076ms ago: executing program 1 (id=43): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x700000f, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) brk(0x55555ede6001) 304.132223ms ago: executing program 0 (id=44): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0x3}, {0xfff3}}}, 0x24}}, 0x4000000) mount(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='aio\x00', 0xc410, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) writev(r4, 0x0, 0x0) execveat(r4, 0x0, 0x0, &(0x7f0000000380), 0x1000) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x20000, 0x80) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/warn_count', 0x100, 0x24) pread64(r5, &(0x7f0000000040)=""/41, 0x29, 0x0) open(&(0x7f00000003c0)='./mnt\x00', 0x2d2c02, 0x8) 237.557438ms ago: executing program 3 (id=45): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0x48}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0x20) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0xc, @mcast1}, 0x1c) 84.946572ms ago: executing program 2 (id=46): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xec776000) getrandom(&(0x7f0000000040)=""/133, 0xfffffffffffffdde, 0x2) 0s ago: executing program 1 (id=47): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file1\x00', 0x800, &(0x7f00000001c0)=ANY=[@ANYRES64=0x0], 0x3, 0x2c5, &(0x7f0000000580)="$eJzs3U+LG2UYAPBnsslsyh6yB08iOIcevFi6vXowRVYQ96Tk4B/QYlsom1DYhYB/MPTkJ/Dgwe/hzbvgxW8gePDozSILr8xkMskm22yzmlbq73fp22eeZ+Z53xk2C2He/fSV0fHdh6f3H331a3S7WbT60Y/HWexHK2ZSLQCAF8LjlOKPK32+t1vb6gkA2K6Fz//OE1J2V0NvbrstAGCL3v/gw3dvHx0dvlcU3YjRN+NBFtN/p8dv348HMYx7cTN6cTb/LiCl6fjtd44Oo12U9uP6aDIelJWjT35uUvOo6g+iF/sX1x8UUwv1k3G7+s0jyyIe9MtGbkUvXlqpL48f3rqgPgZ5vNatJ1le/0b04pfP4mEM4271ncb8+l/nUbyVvv3zy4/K5LI+m4wHu1XeXNp51vcGAAAAAAAAAAAAAAAAAAAAAIAX142isR/XR2Vouv/OYOesOj5PKP9b7a/Tqo5P67OIvBos7Q80SfH9bH+dm0VRpGya3+zvc60dL7ej/bzmDQAAAAAAAAAAAAAAAAAAAP8lp59/cXxnOLx38q8M6pf8m9f6r3qe/kLk1VifvLvRtWKnTi97Xc45+OnjURMpJ3GV5sedImJdz52VyLWyn8vP/FdKKWVZxD+7TZ2nudYlg731OeUC//jd3uvHd7KlNezUy99EurMb98PiefI4mT1LTXlk6y96di6SNnr88jU5ed3IU51nb5PF3F3t8I3fzq1PdsksOguRTj2IJz1+3Y2e5+3/7AEAAAAAAAAAAAAAAAAAAM6bv/R7wcFHa0tbW2sKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ6x+d//nw9iJbI0mMTv0atPsJqTUpo0kTxOTp/zFAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+DsAAP//+nhkpw==") r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) truncate(&(0x7f0000000240)='./file1\x00', 0x3c4c) setns(r2, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.916490][ T28] audit: type=1400 audit(1790867391.911:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.919666][ T28] audit: type=1400 audit(1790867391.911:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.922369][ T28] audit: type=1400 audit(1790867391.911:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[12244]" dev="pipefs" ino=12244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.925984][ T28] audit: type=1400 audit(1790867391.911:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.928738][ T28] audit: type=1400 audit(1790867391.911:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.903151][ T233] scp (233) used greatest stack depth: 22216 bytes left Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. [ 22.120558][ T28] audit: type=1400 audit(1790867399.111:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.121684][ T279] cgroup: Unknown subsys name 'net' [ 22.146039][ T28] audit: type=1400 audit(1790867399.111:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.175521][ T28] audit: type=1400 audit(1790867399.141:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.175666][ T279] cgroup: Unknown subsys name 'devices' [ 22.286654][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.292756][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.425626][ T28] audit: type=1400 audit(1790867399.421:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.449425][ T28] audit: type=1400 audit(1790867399.421:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.468588][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.474875][ T28] audit: type=1400 audit(1790867399.421:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.506634][ T28] audit: type=1400 audit(1790867399.481:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.532722][ T28] audit: type=1400 audit(1790867399.481:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.566970][ T28] audit: type=1400 audit(1790867399.561:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.567408][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.592578][ T28] audit: type=1400 audit(1790867399.561:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.336580][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.343667][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.351319][ T287] device bridge_slave_0 entered promiscuous mode [ 23.368507][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.375661][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.382987][ T287] device bridge_slave_1 entered promiscuous mode [ 23.415835][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.422985][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.431960][ T288] device bridge_slave_0 entered promiscuous mode [ 23.438993][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.446088][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.455154][ T288] device bridge_slave_1 entered promiscuous mode [ 23.532354][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.540202][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.547673][ T290] device bridge_slave_0 entered promiscuous mode [ 23.556028][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.563164][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.570901][ T290] device bridge_slave_1 entered promiscuous mode [ 23.675991][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.683322][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.690952][ T289] device bridge_slave_0 entered promiscuous mode [ 23.698088][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.705337][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.712745][ T289] device bridge_slave_1 entered promiscuous mode [ 23.742633][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.750170][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.757612][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.764865][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.798010][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.808158][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.816554][ T294] device bridge_slave_0 entered promiscuous mode [ 23.823559][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.830750][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.838470][ T294] device bridge_slave_1 entered promiscuous mode [ 23.877076][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.884171][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.891472][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.898769][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.936210][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.943356][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.950767][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.958726][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.018811][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.026580][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.033866][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.041518][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.048999][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.056474][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.064423][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.072315][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.096567][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.105203][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.112385][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.119961][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.129269][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.136642][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.155025][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.163978][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.172782][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.180036][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.187711][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.196092][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.203215][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.235718][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.246811][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.254683][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.264460][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.274779][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.284832][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.293454][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.303058][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.312185][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.320478][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.327964][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.337913][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.346434][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.355549][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.362793][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.371705][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.380742][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.388271][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.396957][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.419814][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.430541][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.439401][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.448290][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.458900][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.468280][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.476549][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.484778][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.493423][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.501425][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.516197][ T287] device veth0_vlan entered promiscuous mode [ 24.532570][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.541196][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.561314][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.569693][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.578600][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.587527][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.596938][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.605439][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.621123][ T288] device veth0_vlan entered promiscuous mode [ 24.629262][ T287] device veth1_macvtap entered promiscuous mode [ 24.638887][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.647172][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.655411][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.666012][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.677887][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.686996][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.696132][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.718520][ T290] device veth0_vlan entered promiscuous mode [ 24.726215][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.734721][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.744317][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.755943][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.769841][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.782426][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.791497][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.801213][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.813167][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.823295][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.842904][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.849205][ T290] device veth1_macvtap entered promiscuous mode [ 24.869153][ T289] device veth0_vlan entered promiscuous mode [ 24.879978][ T288] device veth1_macvtap entered promiscuous mode [ 24.893194][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.901980][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.913092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.924053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.934309][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.944329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.954070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.964486][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.976280][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.984978][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.993626][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.005499][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.016340][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.024239][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.032473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.042045][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.051568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.062477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.071671][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.080533][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.088905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.143612][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.158245][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.168651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.179195][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.191239][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.204246][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.213911][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.223255][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.234691][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.243745][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.254580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.263982][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.312357][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.322806][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.359213][ T289] device veth1_macvtap entered promiscuous mode [ 25.412127][ T294] device veth0_vlan entered promiscuous mode [ 25.421175][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.431343][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.440584][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.448299][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.456054][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.473187][ T318] netlink: 'syz.1.7': attribute type 1 has an invalid length. [ 25.481414][ T318] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7'. [ 25.492206][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.499446][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.513573][ T294] device veth1_macvtap entered promiscuous mode [ 25.521523][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.535396][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.545791][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.562498][ T327] loop1: detected capacity change from 0 to 512 [ 25.569701][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.579225][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.596331][ T327] EXT4-fs: Mount option(s) incompatible with ext2 [ 25.603599][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.618167][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.722161][ T337] loop0: detected capacity change from 0 to 512 [ 25.734694][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.744172][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.754000][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.770293][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.853138][ T342] ip_tables: iptables: counters copy to user failed while replacing table [ 25.947675][ T337] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 25.982023][ T337] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 26.027389][ T337] capability: warning: `syz.0.1' uses 32-bit capabilities (legacy support in use) [ 26.047669][ T337] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 26.069748][ T337] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 1 with error 28 [ 26.090040][ T351] loop7: detected capacity change from 0 to 16384 [ 26.096807][ T337] EXT4-fs (loop0): This should not happen!! Data will be lost [ 26.096807][ T337] [ 26.098159][ T353] loop4: detected capacity change from 0 to 2048 [ 26.111875][ T337] EXT4-fs (loop0): Total free blocks count 0 [ 26.124720][ T337] EXT4-fs (loop0): Free/Dirty block details [ 26.134684][ T337] EXT4-fs (loop0): free_blocks=65281 [ 26.153077][ T353] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 26.158080][ T337] EXT4-fs (loop0): dirty_blocks=6 [ 26.175146][ T337] EXT4-fs (loop0): Block reservation details [ 26.182677][ T337] EXT4-fs (loop0): i_reserved_data_blocks=6 [ 26.194371][ T353] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 26.224335][ T294] EXT4-fs (loop4): unmounting filesystem. [ 26.233346][ T308] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 2 with max blocks 1 with error 28 [ 26.268427][ T357] loop7: detected capacity change from 16384 to 0 [ 26.398964][ T364] syz.0.17 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 26.684878][ T367] process 'syz.1.18' launched './file0' with NULL argv: empty string added [ 26.742514][ T361] SELinux: failed to load policy [ 26.919737][ T397] Zero length message leads to an empty skb [ 26.954000][ T399] loop2: detected capacity change from 0 to 256 [ 26.983388][ T399] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 27.219786][ T412] device syzkaller0 entered promiscuous mode [ 27.256839][ T28] kauditd_printk_skb: 85 callbacks suppressed [ 27.256853][ T28] audit: type=1400 audit(1790867404.251:159): avc: denied { write } for pid=411 comm="syz.0.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.465972][ T28] audit: type=1400 audit(1790867404.461:160): avc: denied { read write } for pid=416 comm="syz.0.39" name="control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 27.493507][ T417] FAULT_INJECTION: forcing a failure. [ 27.493507][ T417] name failslab, interval 1, probability 0, space 0, times 1 [ 27.507405][ T28] audit: type=1400 audit(1790867404.461:161): avc: denied { open } for pid=416 comm="syz.0.39" path="/4/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 27.536291][ T417] CPU: 1 PID: 417 Comm: syz.0.39 Not tainted syzkaller #0 [ 27.543961][ T417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.554809][ T417] Call Trace: [ 27.558202][ T417] [ 27.561168][ T417] __dump_stack+0x21/0x24 [ 27.566025][ T417] dump_stack_lvl+0x110/0x170 [ 27.570935][ T417] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.576516][ T417] ? _find_next_bit+0x129/0x130 [ 27.582013][ T417] dump_stack+0x15/0x24 [ 27.586932][ T417] should_fail_ex+0x3bf/0x510 [ 27.593343][ T417] __should_failslab+0xac/0xf0 [ 27.599160][ T417] should_failslab+0x9/0x20 [ 27.605414][ T417] __kmem_cache_alloc_node+0x3d/0x2d0 [ 27.612305][ T417] ? blkg_alloc+0xdd/0x730 [ 27.617281][ T417] ? pcpu_memcg_post_alloc_hook+0x17e/0x270 [ 27.623204][ T417] ? blkg_alloc+0xdd/0x730 [ 27.627661][ T417] kmalloc_node_trace+0x26/0xb0 [ 27.632553][ T417] blkg_alloc+0xdd/0x730 [ 27.637201][ T417] blkcg_init_disk+0x233/0x460 [ 27.642526][ T417] ? __cfi_blkcg_init_disk+0x10/0x10 [ 27.648579][ T417] ? _raw_spin_lock+0x94/0xf0 [ 27.655946][ T417] ? __cfi__raw_spin_lock+0x10/0x10 [ 27.664133][ T417] __alloc_disk_node+0x238/0x470 [ 27.668027][ T28] audit: type=1400 audit(1790867404.481:162): avc: denied { ioctl } for pid=416 comm="syz.0.39" path="/4/dev/mapper/control" dev="devtmpfs" ino=266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 27.671376][ T417] __blk_alloc_disk+0x2c/0x80 [ 27.671414][ T417] dm_create+0x4d6/0xdb0 [ 27.719984][ T417] ? futex_wait+0x5f1/0x900 [ 27.724936][ T417] dev_create+0x12e/0x2c0 [ 27.729383][ T417] ? __cfi_futex_wait+0x10/0x10 [ 27.736377][ T417] ? __cfi_dev_create+0x10/0x10 [ 27.742127][ T417] ? __cfi_dev_create+0x10/0x10 [ 27.747770][ T417] ? __kasan_check_write+0x14/0x20 [ 27.754387][ T417] dm_ctl_ioctl+0x95f/0xd00 [ 27.759658][ T417] ? __cfi_dev_create+0x10/0x10 [ 27.766288][ T417] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 27.775050][ T417] ? security_file_ioctl+0x95/0xc0 [ 27.781436][ T417] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 27.788172][ T417] __se_sys_ioctl+0x12f/0x1b0 [ 27.794092][ T417] __x64_sys_ioctl+0x7b/0x90 [ 27.799856][ T417] x64_sys_call+0x58b/0x9a0 [ 27.805392][ T417] do_syscall_64+0x4c/0xa0 [ 27.810947][ T417] ? clear_bhb_loop+0x30/0x80 [ 27.817328][ T417] ? clear_bhb_loop+0x30/0x80 [ 27.823247][ T417] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.830979][ T417] RIP: 0033:0x7f4944b9e159 [ 27.836764][ T417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.862733][ T417] RSP: 002b:00007f49459d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 27.873331][ T417] RAX: ffffffffffffffda RBX: 00007f4944e25fa0 RCX: 00007f4944b9e159 [ 27.881790][ T417] RDX: 0000200000000000 RSI: 00000000c138fd03 RDI: 0000000000000003 [ 27.890842][ T417] RBP: 00007f4944c3506b R08: 0000000000000000 R09: 0000000000000000 [ 27.899660][ T417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.908858][ T417] R13: 00007f4944e26038 R14: 00007f4944e25fa0 R15: 00007ffef458c958 [ 27.918203][ T417] [ 27.964818][ T421] device syzkaller0 entered promiscuous mode [ 27.998372][ T28] audit: type=1400 audit(1790867404.981:163): avc: denied { setopt } for pid=420 comm="syz.3.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.047408][ T28] audit: type=1400 audit(1790867404.981:164): avc: denied { ioctl } for pid=420 comm="syz.3.42" path="socket:[16130]" dev="sockfs" ino=16130 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.135037][ T28] audit: type=1400 audit(1790867405.021:165): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.160059][ T431] netlink: 4 bytes leftover after parsing attributes in process `syz.0.44'. [ 28.219836][ T28] audit: type=1400 audit(1790867405.211:166): avc: denied { name_bind } for pid=429 comm="syz.3.45" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 28.334339][ T427] ================================================================== [ 28.344421][ T427] BUG: KASAN: use-after-free in ipt_do_table+0x6e6/0x15a0 [ 28.355423][ T427] Read of size 8 at addr ffff888130054000 by task syz.0.44/427 [ 28.363698][ T427] [ 28.366746][ T427] CPU: 1 PID: 427 Comm: syz.0.44 Not tainted syzkaller #0 [ 28.374345][ T427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.384960][ T427] Call Trace: [ 28.388755][ T427] [ 28.392489][ T427] __dump_stack+0x21/0x24 [ 28.396936][ T427] dump_stack_lvl+0x110/0x170 [ 28.401650][ T427] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.407432][ T427] ? _raw_spin_lock+0x94/0xf0 [ 28.412238][ T427] ? _raw_spin_unlock+0x4c/0x70 [ 28.418024][ T427] ? ipt_do_table+0x6e6/0x15a0 [ 28.423594][ T427] print_address_description+0x71/0x200 [ 28.429800][ T427] print_report+0x4a/0x60 [ 28.434355][ T427] kasan_report+0x122/0x150 [ 28.439004][ T427] ? ipt_do_table+0x6e6/0x15a0 [ 28.444054][ T427] __asan_report_load8_noabort+0x14/0x20 [ 28.450425][ T427] ipt_do_table+0x6e6/0x15a0 [ 28.455122][ T427] ? ipt_do_table+0x2c1/0x15a0 [ 28.460152][ T427] ? __cfi_ipt_do_table+0x10/0x10 [ 28.465836][ T427] ? memcpy+0x56/0x70 [ 28.470656][ T427] iptable_mangle_hook+0x196/0x4d0 [ 28.475984][ T427] ? __kasan_check_write+0x14/0x20 [ 28.482068][ T427] ? __skb_clone+0x453/0x6d0 [ 28.487127][ T427] ? __cfi_iptable_mangle_hook+0x10/0x10 [ 28.493086][ T427] nf_hook_slow+0xca/0x200 [ 28.497907][ T427] ip_mc_output+0x802/0x8d0 [ 28.502588][ T427] ? nf_nat_ipv4_local_fn+0x305/0x540 [ 28.508097][ T427] ? __cfi_ip_mc_output+0x10/0x10 [ 28.514190][ T427] ? nf_hook_slow+0x1bd/0x200 [ 28.518911][ T427] ? __ip_local_out+0x3d2/0x3e0 [ 28.523816][ T427] ? __cfi___ip_local_out+0x10/0x10 [ 28.532168][ T427] ? __cfi_ip_mc_finish_output+0x10/0x10 [ 28.538301][ T427] ip_send_skb+0xc3/0x150 [ 28.543864][ T427] udp_send_skb+0xa6a/0x13a0 [ 28.549747][ T427] udp_sendmsg+0x17e8/0x2170 [ 28.554383][ T427] ? memcg_rstat_updated+0x56/0x110 [ 28.560030][ T427] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 28.565603][ T427] ? __cfi_udp_sendmsg+0x10/0x10 [ 28.571134][ T427] ? selinux_socket_sendmsg+0x22f/0x340 [ 28.576798][ T427] ? cgroup_rstat_updated+0xf0/0x360 [ 28.582419][ T427] ? inet_send_prepare+0x60/0x4d0 [ 28.588948][ T427] inet_sendmsg+0xb6/0xd0 [ 28.593578][ T427] ? __cfi_inet_sendmsg+0x10/0x10 [ 28.598891][ T427] ____sys_sendmsg+0x5fb/0x9c0 [ 28.603811][ T427] ? __sys_sendmsg_sock+0x40/0x40 [ 28.609661][ T427] ? import_iovec+0x7c/0xb0 [ 28.614199][ T427] ___sys_sendmsg+0x2a2/0x360 [ 28.620058][ T427] ? __sys_sendmsg+0x290/0x290 [ 28.627458][ T427] ? up_read+0x56/0x1d0 [ 28.632007][ T427] __sys_sendmmsg+0x2cc/0x4e0 [ 28.637075][ T427] ? __cfi___sys_sendmmsg+0x10/0x10 [ 28.642526][ T427] ? fpregs_restore_userregs+0x128/0x260 [ 28.649914][ T427] __x64_sys_sendmmsg+0xa0/0xb0 [ 28.655034][ T427] x64_sys_call+0x3f5/0x9a0 [ 28.659972][ T427] do_syscall_64+0x4c/0xa0 [ 28.665245][ T427] ? clear_bhb_loop+0x30/0x80 [ 28.670844][ T427] ? clear_bhb_loop+0x30/0x80 [ 28.677289][ T427] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.685425][ T427] RIP: 0033:0x7f4944b9e159 [ 28.690457][ T427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.714736][ T427] RSP: 002b:00007f49459d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 28.725012][ T427] RAX: ffffffffffffffda RBX: 00007f4944e25fa0 RCX: 00007f4944b9e159 [ 28.733373][ T427] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000005 [ 28.741464][ T427] RBP: 00007f4944c3506b R08: 0000000000000000 R09: 0000000000000000 [ 28.751293][ T427] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 28.760939][ T427] R13: 00007f4944e26038 R14: 00007f4944e25fa0 R15: 00007ffef458c958 [ 28.769944][ T427] [ 28.774145][ T427] [ 28.776833][ T427] The buggy address belongs to the physical page: [ 28.783707][ T427] page:ffffea0004c01500 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x130054 [ 28.795072][ T427] flags: 0x4000000000000000(zone=1) [ 28.800873][ T427] raw: 4000000000000000 ffff8881f6e3c9d8 ffff8881f6e3c9d8 0000000000000000 [ 28.809775][ T427] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 28.819842][ T427] page dumped because: kasan: bad access detected [ 28.827316][ T427] page_owner tracks the page as freed [ 28.834613][ T427] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP|__GFP_ZERO), pid 289, tgid 289 (syz-executor), ts 23465126309, free_ts 28275711899 [ 28.858778][ T427] post_alloc_hook+0x1f5/0x210 [ 28.863602][ T427] prep_new_page+0x1c/0x110 [ 28.868469][ T427] get_page_from_freelist+0x2ca9/0x2d20 [ 28.874936][ T427] __alloc_pages+0x1fa/0x610 [ 28.879587][ T427] __kmalloc_large_node+0xa1/0x1c0 [ 28.884821][ T427] __kmalloc_node+0xdf/0x1e0 [ 28.889831][ T427] kvmalloc_node+0x28a/0x460 [ 28.895211][ T427] alloc_netdev_mqs+0x8d/0xfb0 [ 28.899994][ T427] tun_set_iff+0x547/0xee0 [ 28.905386][ T427] __tun_chr_ioctl+0x88c/0x1ef0 [ 28.910451][ T427] tun_chr_ioctl+0x2a/0x40 [ 28.915156][ T427] __se_sys_ioctl+0x12f/0x1b0 [ 28.920463][ T427] __x64_sys_ioctl+0x7b/0x90 [ 28.925176][ T427] x64_sys_call+0x58b/0x9a0 [ 28.929767][ T427] do_syscall_64+0x4c/0xa0 [ 28.934216][ T427] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.940476][ T427] page last free stack trace: [ 28.945940][ T427] free_unref_page_prepare+0x81b/0x820 [ 28.951680][ T427] free_unref_page+0x93/0x530 [ 28.957694][ T427] __free_pages+0x67/0x100 [ 28.962224][ T427] free_large_kmalloc+0xae/0xf0 [ 28.967330][ T427] kfree+0x8b/0xf0 [ 28.971621][ T427] kvfree+0x35/0x40 [ 28.976014][ T427] netdev_freemem+0x3f/0x60 [ 28.980948][ T427] netdev_release+0x7f/0xb0 [ 28.985557][ T427] device_release+0xa4/0x1d0 [ 28.990234][ T427] kobject_put+0x19d/0x280 [ 28.994649][ T427] netdev_run_todo+0xb48/0xc30 [ 28.999397][ T427] rtnetlink_rcv_msg+0xb75/0xde0 [ 29.004518][ T427] netlink_rcv_skb+0x200/0x450 [ 29.010599][ T427] rtnetlink_rcv+0x1c/0x20 [ 29.015583][ T427] netlink_unicast+0x8c1/0xa60 [ 29.020786][ T427] netlink_sendmsg+0x8b9/0xbd0 [ 29.026452][ T427] [ 29.028954][ T427] Memory state around the buggy address: [ 29.035024][ T427] ffff888130053f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.043469][ T427] ffff888130053f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.052493][ T427] >ffff888130054000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.062745][ T427] ^ [ 29.066906][ T427] ffff888130054080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.075008][ T427] ffff888130054100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.083078][ T427] ================================================================== [ 29.092346][ T427] Disabling lock debugging due to kernel taint [ 29.124462][ T28] audit: type=1400 audit(1790867406.111:167): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 29.198840][ T28] audit: type=1400 audit(1790867406.111:168): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 29.316503][ T431] syz.0.44 (431) used greatest stack depth: 21600 bytes left